cryptoaml[.]ai

Analysis of cryptoaml.ai indicates a high-risk phishing domain targeting cryptocurrency users. The domain was registered on May 22, 2026, and remains active as of July 12, 2026. It resolves to IP address 104.21.54.113, hosted under Cloudflare infrastructure. The page title, 'CryptoAML.ai — AML Check Any Crypto Wallet in Seconds,' suggests a fraudulent anti-money laundering (AML) verification service, likely designed to harvest wallet credentials or sensitive financial data. Security vendors have flagged the domain, with 5 out of 95 detections on VirusTotal classifying it as malicious. The domain appears in 14 threat intelligence pulses on AlienVault OTX and is listed on two security blocklists: PhishDestroy and BLP-Malware. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. The SSL certificate is issued by Google Trust Services, which does not mitigate the underlying threat. Defenders should treat this domain as actively malicious. Block access to 104.21.54.113 and monitor for connections from internal networks. Given its recent registration and persistent activity, cryptoaml.ai is likely part of a broader phishing campaign targeting cryptocurrency wallets. No evidence of a specific phishing kit or additional infrastructure links has been confirmed at this time. Further investigation into associated wallet addresses or transaction patterns is recommended.